pen testing

Deviant Ollam, head of a physical penetration testing team, presents tactics for getting into buildings, from bypassing door levers with a wire to defeating bank doors. He argues that physical security is often surprisingly weak.

Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

Ted Young of LightStep proposes trace testing, using distributed tracing data to unify testing and observability. The KubeCon-era talk argues for testing against trace data rather than treating tests and monitoring separately.

Deviant Ollam's two-hour conference talk explains how elevators work, from the pit and buffers to the car top, controller logic and access-control features. It shows how this knowledge can be used for optimization and for bypassing building security.

Theo de Raadt presents pledge, a new OpenBSD security mechanism that kills processes which exceed the system calls they declared they need. The talk was given late at night at Hackfest 2015.

A 36C3 talk that systematically evaluates OpenBSD's exploit mitigations, asking how effective they really are and what they cost in performance, complexity and inspectability. It challenges the project's security marketing.

Evan Czaplicki, creator of Elm, discusses the hard parts of running an open source project: online community conflict, why its patterns arise, and a cultural history of open source. He offers ideas for more civil, productive communication.

Sandi Metz's RailsConf 2013 talk offers practical guidelines for deciding what to test and how, so tests stay cheap and stable. She argues for testing the public interface rather than implementation and using mocks appropriately.

Will Wilson explains autonomous testing: using deterministic simulation and fuzzing, building on FoundationDB's approach, to test software continuously. It sets out the ideas behind his later company Antithesis.

John Hughes, co-creator of QuickCheck, talks about property-based testing of hard systems. He shows production examples where it found very low-level bugs, including issues in the CAN bus standard.

David Heinemeier Hansson's opening keynote at RailsConf 2019 argues against the expectation of payment for open source work, drawing on his experience releasing Rails. It also includes lighter asides about the industry.

A beginner-focused tutorial on freehand knife sharpening with a single stone, aiming for a shaving-sharp edge in about five minutes.

Hillel Wayne's PyCon 2018 talk on testing beyond pytest and mypy. It introduces property-based testing with the Hypothesis library and design-by-contract with dpcontracts, and shows how to combine them with an existing test suite.

Bobby McFerrin uses audience participation at a World Science Festival event to demonstrate how instinctively people follow the pentatonic scale.

CGP Grey's short animated argument for abolishing the US penny, covering its cost and history.

Bryan Cantrill's talk on corporate open source anti-patterns, first given at FISL 2012 and again at the Liferay Symposium. He lays out the mistakes companies make when open sourcing code, such as announcing future open sourcing, and discusses licenses.

A dotJS 2012 conference talk by Fat (of Twitter Bootstrap fame) on what open source really means and why maintainers feel guilty about it. It covers the obligations, expectations and burnout that come with releasing popular open source software, delivered with humor.

David Christiansen gives a Strange Loop 2018 introduction to dependent types, where one language serves for both compile-time and run-time code and programs unite with proofs. It draws on his book The Little Typer.

Bryan Cantrill's OSCON 2015 talk on moving a proprietary product to open source, drawing on Sun's history with Solaris and illumos, licensing choices and the relicensing after Oracle's acquisition.

Tim Ansell presents the SkyWater PDK, a fully open source manufacturable process development kit for a 130nm process, as the first FOSSi Dial-Up talk. He covers its role in a fully open chip design flow.

A short CNET demo of Bose's electromagnetic active suspension, which gave a very smooth ride but never reached the market. It shows the system in action.

A short hyperlapse of a 2019 Toyota Corolla using comma.ai's OpenPilot 0.6.3 to drive 100 miles with no intervention except for the windshield wipers.

Project Farm tests six penetrating oils, including WD-40, PB Blaster, Liquid Wrench and an ATF and acetone mix, on rusted bolts. Liquid Wrench placed first and the homemade mix second.

Bob Beck of OpenBSD describes the first month of LibreSSL, the fork aimed at cleaning up OpenSSL, including oddities found in the code base and why it was cleaned rather than audited cryptographically.

Poul-Henning Kamp's FOSDEM 2014 talk is a hypothetical account of how an intelligence agency such as the NSA would sabotage open source software, standards and online discussion. It covers Skype's history, OpenSSL and psyops against standards.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

Bob Beck of OpenBSD gives a BSDCan 2014 talk on the first month of LibreSSL, the OpenSSL fork. He explains why they forked, what they removed, and examples of the problems found in the OpenSSL code base.

A roughly 14-minute interview with OpenBSD founder Theo de Raadt at ruBSD 2013. He talks about making painful changes, getting real feedback, mitigation techniques compared to other OSs, and virtualization.

A short film from the Competitive Enterprise Institute adapting Leonard Read's 1958 essay I, Pencil, showing how no one person knows how to make a pencil and how many people cooperate without central planning.

Urs Hoelzle, Google's SVP of infrastructure, gives the 2012 Open Networking Summit keynote on how Google adopted OpenFlow and software-defined networking in its own networks. The slides are linked in the description.

Alen Ladavac of Croteam talks about continuous integration and automated testing pipelines in games, with case studies from The Talos Principle and Serious Sam.

A TU Vienna demo of a double inverted pendulum on a cart, using constrained feedforward and optimal feedback control for swing-up and point-to-point motion.

A short Global News report on the Pentagon confirming a $22 million UFO investigation program and releasing Navy infrared footage from the 2004 Nimitz encounter.

Lex Fridman's long interview with OpenAI CEO Sam Altman about GPT-4, ChatGPT, and the future of AI. Topics include models as reasoning engines, AI risk, and consciousness.

Sam Altman accepts the 2023 Hawking Fellowship at the Cambridge Union and speaks about OpenAI, AGI and AI safety, recorded November 1, 2023. It includes his comments on what is left for AGI and on discovering new physics.

Sintel is a 15-minute animated fantasy short made by the Blender Foundation to develop and showcase Blender, funded by community donations and released under Creative Commons.

Part two of a StrictlyVC interview with OpenAI CEO Sam Altman, focused on AI. He discusses regulation, commodification of AI, Google's reluctance to release its own models, and best- and worst-case futures.

Lex Fridman interviews OpenAI CEO Sam Altman about GPT-4, GPT-5, Sora, the OpenAI board saga, Elon Musk, Ilya Sutskever, power and AGI. The conversation runs nearly two hours.

Short clip of Donald Rumsfeld's 9/10/2001 speech acknowledging that $2.3 trillion in Pentagon transactions could not be tracked.